Recently, I have been focused on adding support for Microsoft.FileUsageSync.db. See my previous post on Microsoft.FileUsageSync.db. The recent_files_formatted_spo table was the focus of this work. To my surprise, this table holds a wealth of information. Microsoft.FileUsageSync.db tracks how files are being used including email, meetings, events, Teams chats, notes, and SharePoint. Let's take a peak into the changes to OneDriveExplorer and these new data points.
Off the bat you will notice a new sidebar containing the data points I mentioned earlier. The data points will be enabled once data has been added that pertains to that particular data point.
The next big change comes to the file menu. OneDrive settings has been changed to OneDrive metadata. This made more sense because the menu contains more options besides the OneDrive settings items. Parsing has been simplified. You can now select the Profile option, point it to a users OneDrive profile, and OneDriveExplorer will take care of the rest. There is an option to load individual files and import saved data from the command line version of OneDriveExplorer.
Loading individual files has become more intuitive with the new menu. It contains options for all supported files by OneDriveExplorer.
Import JSON has stayed the same but there is a slight update to Import CSV. This is because OneDriveExplorer saves the Microsoft.FileUsageSync.db to a separate csv.
OneDriveExplorer now can handle unmanaged exceptions and write to a log.
What kind of data does the Microsoft.FileUsageSync.db hold? Email, meetings, events, Teams chats, notes, and SharePoint data. I'll walk through what this data looks like in OneDriveExplorer.
The email section contains data for files that have been shared through email. Please note that this information does not contain the body of the email. On the left will be a list of emails by sender, subject and date. When selected, the data will be presented in a familiar format resembling what you might see in an email client. Below that will contain the information about the file being shared. And there is a lot! Way too much to list here.
The meeting and events sections are very similar in nature. These sections hold data for files that have been shared via meeting or events. Like the email data, a list of meetings/events will be listed on the left. The middle contains various metadata that pertains to the meeting/event along with the metadata of the file being shared. Meeting/event participants are listed on the right.
The chat/notes sections contain the same type of data. These are files that are shared through Teams. The only difference is that notes are files shared with oneself. Chat/Note subject is on the left. If there is a subject, the list will be populated with the subject. If there is no subject, the list of participants will be combined like in Teams. The file metadata will be in the middle and participants on the right.
The SharePoint section contains data on files that have been shared through SharePoint. On the left will list the SharePoint site. The middle will list the files being shared. When a file is selected, the metadata for that file will be populated.
The file metadata contains too much information to list it all here. There is one thing I would like to show. There is a section in the file metadata call activity. It's not always populated but when it is, it can show various activities such as:
As you can see, Microsoft.FileUsageSync.db holds a lot of information. And remember, this is only one column from one table in the database. You can find the latest version of OneDriveExplorer on GithHub.
